ThreatPress

WordPress Vulnerabilities Database

Back

WordPress Subscribe to Comments Plugin <= 2.1.2 - Local File Inclusion

Product
Subscribe to Comments
Description
Because of this vulnerability, administrators can upload PHP files, also, they can perform arbitrary code execution by the same method.
Solution
Update the plugin.
Classification
Type Local File Inclusion
OWASP Top 10 A1: Injection
References
SecLists
Packet Storm Security
CVE
Name CVE-N/A
Versions
Affected In <= 2.1.2
Fixed In 2.3
Disclosure date
2015-07-14
Credits
Tom Adams